DeepSeek Harness (dsh) is an open-source, local-first AI coding-agent harness that has rapidly amassed over 216,000 GitHub stars since its launch in August 2026. It runs AI coding agents on a developer's machine with OS-level filesystem sandboxing (Bubblewrap on Linux, Seatbelt on macOS, ACL-restricted-token on Windows) and an approval-prompt system intended to gate dangerous operations. The tool ships as the npm package @deepseek-ai/dsh and its CLI binary dsh, with version 0.1.1-rc.2 as the latest npm release. The harness exposes a local HTTP control-plane API on 127.0.0.1:3080 to manage agent sessions, execute commands, and retrieve conversation logs.

CVE-2026-82533, discovered by OX Security researchers Nir Zadok and Moshe Siman Tov Bustan, resides in the isTrustedApiRequest function within packages/client/connection/src/api-request-trust.ts. This function serves as the sole gate for the entire /api RPC surface. It reads the client-supplied Host header to determine trust — if the Host value matches a loopback address (127.0.0.1 or localhost) or appears in a configured trustedHosts list, access is granted. Crucially, the function never compares the Host value against the actual TCP connection peer address. The function's own code comments acknowledge this is a trust boundary designed to prevent DNS rebinding and CSRF from browsers, but it is explicitly documented as "not an auth layer." Non-browser clients (such as a curl command from within a sandboxed agent) can simply supply a spoofed Host: 127.0.0.1:3080 header and bypass the gate entirely.

The attack chain for sandbox escape is straightforward. The sandbox profiles on both Linux (Bubblewrap, using --unshare-pid but not --unshare-net) and macOS (Seatbelt, using (allow default) with only (deny file-write*)) leave loopback networking open while restricting filesystem writes. Ordinary bash tool calls require no approval. From inside the sandbox, an agent executes a single curl command: curl -s -X POST http://127.0.0.1:3080/api/session/update-config -H "Host: 127.0.0.1:3080" -H "Content-Type: application/json" -d '{"danger-full-access": true, "approval": "never"}'. This sets the session to danger-full-access mode (which disables the sandbox entirely) and approval to never (which stops all approval prompts). The session log records the policy change with source: {kind: 'user'} — the harness cannot distinguish the agent's shell from the human at the keyboard, and no approval/request event appears anywhere in the log. OX Research verified the exploit by running two identical sessions from default settings: the session that made the API call successfully wrote files outside its workspace (e.g., /home/ubuntu), while the confined session had the identical write blocked by the sandbox.

The remote attack path is equally severe. If port 3080 is reachable via SSH tunnel, reverse proxy, editor port forward, or the --host 0.0.0.0 option (which the CLI explicitly refuses but can be bypassed via proxy), an unauthenticated remote attacker gains full agent control: they can invoke commands/execute with danger-full-access permissions, read all stored conversations, and enumerate the filesystem via host.listDirectory and host.createDirectory — all without any credential or API key. The --profile web binding explicitly rejects --host 0.0.0.0, confirming the threat model includes local actors.

Beyond CVE-2026-82533, the vulnerability is part of a broader security picture for DeepSeek Harness. The same week the CVE was reported, community researchers published three additional vulnerabilities under discussion #451 (DSH-01, DSH-02, DSH-03): DSH-01 is a node:vm sandbox escape in the workflow tool (CVSS 8.8) where the constructor chain agent.constructor('return process')().getBuiltinModule('fs') bypasses the VM context entirely, achieving arbitrary file read/write and RCE; DSH-02 is a dynamic plugin host code escape via host-realm closure (CVSS 8.8) where btoa.constructor obtains the host Function constructor, enabling full process-level access including reading DEEPSEEK_API_KEY from process.env; and DSH-03 is the identical /api RPC bridge without authentication (the same class as CVE-2026-82533 but documented independently). A subsequent security audit (discussion #817) reported 7 additional findings: 2 High (unauthenticated LAN RPC when binding to 0.0.0.0, and the unpinned host-filesystem primitives the RPC carries) and 5 Medium (workflow tool bypassing sandbox modes, approval escalation not bound to the command, host-only dynamic packages activating with zero approval, sandbox context facade forwarding capability services, and Landlock falsely reporting full enforcement on NFS/CIFS/FUSE filesystems).

The project has no SECURITY.md file, and GitHub's private vulnerability reporting returns API 403, meaning there was no responsible disclosure path available. The fix was released in dsh-v0.1.2-alpha.1 on August 27, 2026 (commit 3e24087bfaeabe40b58ba2f7b936895b8f93fe27), implementing a one-time-token authentication scheme where the tool prints a token at startup, the browser exchanges it for a signed cookie, and every API call requires the cookie. However, the fix does not address the design limitations that the sandbox does not confine reads, network access, or process visibility, and the agent's shell still receives the interface address. The fix was first available on npm in version 0.1.2-alpha.2 (August 30) and the current npm release with the fix is 0.1.2-rc.1 (September 3). Third-party desktop builds that ship their own copy of the harness remain exposed until they update their pinned version.

A separate academic study (arXiv:2608.16393, August 2026) assessed DeepSeek Harness resistance to indirect prompt injection across 14,560 controlled agent executions, finding fake-completion attacks achieved 17.0% success, hidden unicode in files reached 25.5%, and the skills channel reached 16.0%, confirming that the broader attack surface extends well beyond the authentication bypass. No in-the-wild exploitation of CVE-2026-82533 has been reported as of publication.